Taiko Urges Users to Withdraw Funds After $1.7M Bridge Exploit
Quick Look
- Taiko, an Ethereum layer-2 blockchain, has warned users to withdraw assets from its bridges following a hack that drained $1.7 million.
- The exploit compromised the chain's verification mechanism, rendering bridge security assumptions invalid.
- This is the latest in a series of at least 23 crypto exploits this month.
AI-generated summary
Why It Matters
Taiko, an Ethereum layer-2 blockchain, experienced a bridge exploit resulting in $1.7 million in stolen assets. This incident follows a series of other crypto protocol hacks in June.
Taiko, an Ethereum layer-2 blockchain, has urged its users to withdraw assets from the network’s bridges after an exploit on one of its bridge protocols saw attackers make off with $1.7 million in the latest decentralized finance hack this month.
“We have confirmed a compromise of Taiko’s chain state verification mechanism,” Taiko posted to X early on Monday. “As a result, the security assumptions of all bridges deployed on Taiko can no longer be relied upon.”
“We strongly advise all users to withdraw their funds from all bridges deployed on Taiko immediately,” it added.
It is the latest in a series of crypto protocol exploits this month, which now number at least 23, according to DeFiLlama. The Humanity Protocol and Syscoin Bridge, which lost over $30 million and $8 million, respectively, have been the largest two exploits so far in June.
Taiko said it was coordinating partners to contain the incident and had paused affected systems.
Crypto security firm Blockaid said that the root cause appears to be a flaw in how the Taiko bridge validated source signals.
It said that message proofs were accepted as valid on Ethereum without corresponding legitimate proofs on the Taiko blockchain.
“This allowed the attacker to register and later retrieve fraudulent bridge messages, resulting in unauthorized asset releases from the ERC20 vault,” Blockaid said.
Blockaid estimated that at least $1 million had been stolen, while Lookonchain and PeckShield suggested the value of assets stolen could be as high as $1.7 million.
The exploiter has already transferred 1.99 million Taiko (TAIKO) tokens worth around $189,000 to MEXC, stated PeckShield. TAIKO is currently trading down 98% from its 2024 peak at $0.084, according to CoinGecko.
Blockchain intelligence firm Arkham shows Taiko exploiter wallets holding around $1.5 million, primarily in Ether (ETH).
Exploits in June are mounting up
The attack comes just days after the discovery on Friday of a smart contract exploit on the Secret Network, which resulted in the theft of $4.67 million worth of assets.
On Saturday, around $1.1 million was drained from the OLPC/LABUBU liquidity pool on PancakeSwap. LABUBU is a memecoin inspired by the popular toys of the same name.
Other notable exploits in June include Aztec Connect, RetoSwap, Raydium AMM, and the largest one so far this month, Humanity Protocol.
Open Questions
- Will affected users be compensated?
- What specific vulnerabilities were exploited?
- What measures will be taken to prevent future exploits?
